Disconnect the phone if the app is actively controlling the device or initiating transactions. Revoke powerful access such as device administration and Accessibility, then uninstall the app, update Android, and run Google Play Protect and a trusted security scan. Account recovery may still be necessary because removal does not undo data already collected.
Before uninstalling
Use another trusted device to contact a bank or secure email when the suspicious app may be watching the screen, reading notifications, or controlling input. Do not sign in to sensitive accounts on the affected phone until the immediate access is stopped.
Record the app name, icon, developer, installation source, permissions, and any alert. Screenshots can help a financial institution, employer, or security team understand the incident. Do not keep the app running solely to gather more evidence.
Revoke special access
Some apps resist removal because they hold powerful permissions. In Android Settings, review:
- device administrator apps;
- Accessibility services;
- notification access;
- display over other apps;
- install unknown apps;
- VPN profiles;
- usage access and unrestricted battery settings.
Turn off access you did not intend to grant. Menu names vary by Android version and manufacturer. A work-managed phone may require help from the organizationâs administrator.
Uninstall the app
Open the appâs information page in Settings and choose Uninstall, or manage installed apps through Google Play. If only Disable or Uninstall updates appears, the app may be part of the system image. Do not use root tools or random removal utilities; consult the device manufacturer or administrator.
If the screen closes, ads interrupt Settings, or removal fails, restart in safe mode using the manufacturerâs instructions and try again. Safe mode temporarily prevents most downloaded apps from running.
Scan and update the phone
Keep Google Play Protect enabled and run a scan. Update Android, Google Play system components, browsers, and security software. Run Complete Antivirus and review any detection before acting.
Delete the APK or installer from Downloads and remove unfamiliar browser extensions, profiles, or certificates associated with the incident. Restart and scan again.
Review the browser that delivered the file or warning. Remove notification permission for deceptive sites, clear downloads you do not recognize, and check whether the browser gained permission to install unknown apps. If a messaging app delivered the installer, report the sender and remove the file from the conversation without opening it again.
Watch for the same app, pop-up, or setting change after the restart. A clean scan combined with normal permissions and stable behavior is stronger evidence than any one check. If the symptom returns, note the time and app in use so the manufacturer or security provider can investigate a reproducible event.
Secure affected accounts
Removing the app does not revoke account sessions or erase information it already transmitted. From another device you trust:
- Change passwords entered or used while the app was active.
- End unfamiliar sessions and remove unknown devices.
- Turn on two-factor authentication.
- Review email forwarding, recovery details, transactions, and linked apps.
- Contact financial institutions for unauthorized activity or exposed payment access.
If identity information was involved, use IdentityTheft.gov for a recovery plan.
Prioritize accounts according to the appâs access. Notification access can expose sign-in codes and message previews. Accessibility or screen-control access can affect anything used while the app was active. A fake banking app may expose only the credentials entered into that app, while a remote-access tool can expose several sessions. This scope determines which passwords, cards, and records need action.
Check subscriptions and device-management profiles as well as passwords. Uninstalling an app does not cancel a Google Play subscription, remove a work profile, or dispute a charge.
When to consider a factory reset
A factory reset may be appropriate if the app obtained root-level control, installed components you cannot remove, or returns after uninstalling. Consider it as well if the phone remains unreliable after you revoke the appâs special access, remove it, install updates, and complete security scans. Before erasing the phone, back up necessary personal files without copying unknown apps or installers and confirm that your account credentials and two-factor recovery methods work.
Follow the manufacturerâs reset and restore instructions. Reinstall apps from trusted sources rather than restoring every previous package automatically.
How Complete Antivirus helps
Complete Antivirus can identify and help address selected apps and files associated with known threats. Detection changes over time, and a clean scan cannot prove that credentials were not submitted or that an app never transmitted data.
PSafeâs analysis of suspicious-app removal
After removing the app, check both the phone and any accounts or data the app could access. A clean scan does not repair a stolen password, and a password change does not remove software that is still on the device.
Frequently asked questions
Why is the Uninstall button disabled?
The app may have device-administration control, belong to a work policy, or be part of the system. Remove unauthorized special access or contact the administrator or manufacturer.
Does clearing app data remove malware?
It deletes that appâs stored data but leaves the package installed. Uninstall and scan when the app itself is untrusted.
Will a factory reset remove every threat?
It removes ordinary user-installed apps and data. Rare firmware or account-level problems require separate support. Restore carefully so you do not reinstall the same package.
Should I cancel my cards?
Contact the issuer when the app displayed, captured, or used financial information. The institution can decide whether replacement is necessary.